Getting Data In

Multiline events with fields with same name (Windows 2008 logs)

bojanz
Communicator

With Windows 2008 (and Vista) event logs are now much more detailed, however there are some problems with multiple fields which have same names, for example like this:

Subject:  
    Security ID:        S-1-5-18  
    Account Name:       CALLISTO$  
    Account Domain:     DEMO  
    Logon ID:       0x3e7  

Logon Type:         10  

Account For Which Logon Failed:  
    Security ID:        S-1-0-0  
    Account Name:       Administrator  
    Account Domain:     DEMO  

Now, I want to extract only the second "Account Name" field. Splunk automatically extracts both of them, but I want to graph only the second. Any idea how to do it on multiline events like this? I tried with rex and regex but with no success 😞

Thanks.

1 Solution

Lowell
Super Champion

You may be able to prevent splunk from extracting the first value, but there may be times when you'll want the first value but not the second. So perhaps an easier way would be to tell splunk just to grab that second value for your search. Since you always know that you want the second value, you can use an eval statement in your search like this:

sourcetype=WinEventLog:Security "Logon Failed" | eval login_account=mvindex(Account_Name,1) | timechart count by login_account

View solution in original post

Lowell
Super Champion

You may be able to prevent splunk from extracting the first value, but there may be times when you'll want the first value but not the second. So perhaps an easier way would be to tell splunk just to grab that second value for your search. Since you always know that you want the second value, you can use an eval statement in your search like this:

sourcetype=WinEventLog:Security "Logon Failed" | eval login_account=mvindex(Account_Name,1) | timechart count by login_account

bapruski
Explorer

How would you evaluate the Account_Name if in some cases it has only one value (event 4768, 4769) and in some it has two (event 4624)?

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...